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CLAIMS 

What is claimed is: 

1 . An apparatus for providing a fail-operational global time reference for a 
redundant synchronous data bus system including a first primary data bus, a second primary 
data bus, a first redundant data bus, and a second redimdant data bus, the apparatus 
comprising: 

a first plurality of timing servers cross-coupled to said first data buses and 
configured to receive timing synchronization signals firom said second primary data bus; 

a second plurality of timing servers cross-coupled to said second data buses and 
configured to receive timing synchronization signals fi"om said first primary data bus; and 

a imique constant stored in each timing server, 

wherein each said timing server of said first and second pluralities of timing servers 
is configured to independently and automatically execute a selection protocol responsive to 
a failure of a timing master to select one timing server fi-om among the first and second 
pluralities of timing servers to be a replacement timing master based upon synchronization 
signals received firom at least one timing server of said first and second pluralities of timing 
servers and upon a relationship among said unique constants stored in said timing servers. 

2. The apparatus of claim 1, wherein each said timing server is configured to 
produce a timing master synchronization signal when selected as timing master, 

3. The apparatus of claim 1, wherein each said timing server includes a counter. 

4. The apparatus of claim 3, wherein each said timing server is configured to 
transmit, receive, and monitor synchronization signals fi'om each of said first and second 
pluralities of timing servers and wherein each said counter is responsive to a monitored 
failure of said timing master synchronization signal to initiate coimting fi-om a starting point 
to count toward each respective stored unique constant. 
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5. The apparatus of claim 4, wherein each said timing server is further 
configured to transmit a master timing synchronization signal when said counter in said 
timing server has completed counting to said unique constant stored in said timing server. 

6. The apparatus of claim 1 , wherein each said timing server is configured to 
self test its timing synchronization signal. 

7. The apparatus of claim 1, wherein each said timing server is configured to 
test the timing synchronization signals of other timing servers. 
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A/ 

8. A timing server for providing a fail-operational global time service for a 
synchronous data bus system interconnecting at least one plurality of timing servers coupled 
to at least one data bus in said synchronous data bus system, the timing server comprising: 

a first module configured to transmit synchronization signals and to receive and 
monitor synchronization signals firom each timing server of said at least one plurality 
of timing servers; 

a second module configured to store a imique constant; and 

a third module configured to independently and automatically select one or more 
timing servers fi*om among the at least one plurality of timing servers to be timing 
masters based at least partially upon a relationship among unique constants 
associated with each timing server and upon said synchronization signals received 
fi-om one or more of said timing servers of said at least one plurality of timing 
servers. 

9. The timing server of claim 8, wherein said third module is fiirther configured 
to synchronize to said synchronization signal firom said timing master upon first reception of 
said synchronization signal from said timing master. 

10. The timing server of claim 8, wherein said third module is further configured 
to transmit a timing master synchronization signal responsive to receiving timing master 
synchronization signals from two or more other timing servers for more than a 
predetermined period of time. 
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11. An apparatus for providing a fail-operational global time service for a 
synchronous data bus system interconnecting at least one plurality of timing servers coupled 
to at least one data bus in said synchronous data bus system, wherein: 

each said timing server of the at least one plurality of timing servers is initially 
configured to transmit synchronization signals and to receive and monitor synchronization 
signals fi-om each timing server of said at least one pluraUty of timing servers; 

each said timing server of the at least one plurality of timing servers is configured to 
store a unique constant; and 

each said timing server of the at least one plurality of timing servers is configured to 
independently and automatically select one or more timing servers firom among the at least 
one plurality of timing servers to be timing masters based upon said synchronization signals 
received fi-om one or more of said timing servers of said at least one plurality of timing 
servers and based upon a relationship among said unique constants stored in each timing 
server, 

12. The apparatus of claim 1 1 , wherein each said timing server of the at least one 
plurality of timing servers is fiirther configured to synchronize to said synchronization 
signal fi-om said timing master upon first reception of said synchronization signal fi-om said 
timing master, 

1 3 . The apparatus of claim 1 2, wherein each said timing server of the at least one 
plurality of timing servers is fiirther configured to transmit a timing master synchronization 
signal responsive to receiving timing master synchronization signals firom two or more other 
timing servers for more than a predetermined period of time. 

1 4. The apparatus of claim 1 1 , wherein each said timing server of the at least one 
plurality of timing servers is fiirther configured to: 

count toward a unique predetermined constant in response to detection of a failxire of 
the timing master synchronization signal to which said each timing server is synchronized; 
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if no other timing master synchronization signal is received before said counting 
reaches said unique predetermined constant, transmitting a timing master synchronization 
signal; and 

if a timing master synchronization signal is received before said counting reaches 
said unique predetermined value, synchronizing to said received timing master 
synchronization signal. 
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15. A method of selecting a timing master in a fail-operational global time 
reference in a synchronous data bus system having at least one plurality of timing servers 
coupled to at least one data bus of said synchronous data bus system, one said timing server 
acting as a timing master, the method comprising the steps of, in each operable timing 
server of the at least one plurality of timing servers: 

detecting a failure of the timing master synchronization signal; 

counting toward a unique predetermined constant in response to detection of the 
failure of the timing master synchronization signal; 

if no other timing master synchronization signal is received before said counting 
reaches said unique predetermined constant, transmitting a timing master synchronization 
signal; and 

if a timing master synchronization signal is received before said counting reaches 
said unique predetermined value, synchronizing to said received timing master 
synchronization signal. 

1 6. The method of claim 1 5, further comprising a timing master responding to 
reception of a timing master synchronization signal from another timing server by the step 
of ceasing to produce a timing master synchronization signal after a predetermined period of 
time. 

1 7. The method of claim 1 5, further comprising the step of transmitting a timing 
master synchronization signal in response to receiving timing master synchronization 
signals from two or more timing servers for a period longer than a predetermined period. 

18. The method of claim 1 5, further comprising the step of performing one or 
more tests on synchronization signals received from each timing server of the plurality of 
timing servers and adapting said one or more tests responsive to one or more failed tests. 
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19. A method executed in a local timing server coupled to at least one data bus, 
the method comprising the steps of: 

monitoring a timing master synchronization signal from a first remote timing server; 

counting toward a unique constant in response to detecting a failure of said timing 
master synchronization signal in said monitoring step; and 

synchronizing to a second remote timing server as timing master if a master timing 
synchronization signal is received from said second remote timing server during the 
counting step and otherwise transmitting a timing master synchronization signal. 

20. The method of claim 19, further comprising the steps of: 

receiving a second master synchronization signal from a third remote timing server; 

and 

synchronizing to said third remote timing server as timing master. 

21. The method of claim 20, further comprising the step of said local timing 
server ceasing to transmit the timing master synchronization signal. 

22. The method of claim 1 9, wherein two timing master signals from said 
second and third remote timing servers are received for more than a predetermined amount 
of time, the method further comprising the steps of: 

counting toward said unique constant; and 

synchronizing to a fourth remote timing server as timing master if a master timing 
synchronization signal is received from said fourth remote timing server during the coimting 
step and otherwise transmitting a timing master synchronization signal. 

23 . The method of claim 1 9, wherein a timing master synchronization signal is 
no longer being received, the step of counting further comprising the steps of operating said 
local timing server automatically and independently until said synchronizing step. 



24. The method of claim 19, further comprising the steps of: 
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monitoring the synchronization signal from each timing server; and 

determining failure of timing synchronization signals from remote timing servers 
based at least in part on the step of monitoring. 

25. The method of claim 24, fiirther comprising the steps of: 

comparing an actual time of arrival of a first synchronization signal to the designed 
time of arrival of the first synchronization signal and to a predetermined tolerance; and 

determining that the timing server has failed if a difference between the actual time 
of arrival of the first synchronization signal and the designed time of arrival of the first 
synchronization signal exceeds the predetermined tolerance. 

26. The method of claim 25, fiirther comprising the steps of: 

meeisuring a temporal gap between the time of arrival of said first synchronization 
signal and the termination time of a prior, second synchronization signal; and 

determining whether the first synchronization signal or the second synchronization 
signal has failed based, at least in part, on the size of said gap. 

27. The method of claim 1 9, fiirther comprising the steps of: 

monitoring timing parameters of the local timing server to determine internal timing 
integrity; and 

determining failure of said local timing server based at least in part on the step of 
monitoring timing parameters of the local timing server. 

28. The method of claim 27, wherein each timing server is designed to produce 
a frame tick periodically to within a frame tick tolerance, the step of monitoring fiirther 
comprising the steps of: 

comparing an actual frame tick period with the designed frame tick period and said 
frame tick tolerance; and 

determining that said timing server has failed if a difference between the actual 
frame tick period and the designed frame tick period exceeds the frame tick tolerance. 
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29. A program product, comprising: ^ 

A) a set of instructions executable by a timing server to automatically and 
independently select a timing master from among a plurality of identically instracted timing 
servers coupled to at least one bus in a synchronous data bus system, wherein said selection 
is made based upon time synchronization signals received by said timing server and further 
based upon a constant unique to each said timing server; and 

B) signal-bearing media bearing the set of instructions. 

30. The program product of claim 29, wherein said signal-bearing media 
comprises a memory in a timing server. 



25 



